AZ-500 Secure networking Practice Question
A company has Azure virtual machines that need to download updates from specific external websites (e.g., *.microsoft.com and *.windowsupdate.com). The security team wants to centrally manage and allow outbound HTTPS traffic only to these FQDNs, while blocking all other outbound internet access. Which Azure networking service should they deploy to achieve this?
⚠ Common exam trap
Many candidates confuse Azure Firewall with Azure Application Gateway, mistakenly thinking the latter can filter outbound traffic, but Application Gateway is strictly an inbound reverse proxy and cannot enforce outbound FQDN rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Firewall
Azure Firewall is a managed, cloud-native network security service that can centrally enforce outbound FQDN-based rules. It allows you to create application rules that permit HTTPS traffic to specific FQDNs (e.g., *.microsoft.com) while blocking all other outbound internet access, meeting the security team's requirement for granular, centralized control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Firewall
Why this is correct
Azure Firewall is the only option that can control outbound traffic based on FQDN. You deploy it in a dedicated AzureFirewallSubnet and configure application rules with FQDN targets such as *.windowsupdate.com to allow or deny VM-initiated downloads. Unlike NSGs, which filter by IP/port, Azure Firewall inspects Layer 7 DNS and HTTP/S headers to enforce FQDN-based outbound filtering, making it the correct service for this requirement.
- ✗
Azure Application Gateway
Why it's wrong here
Azure Application Gateway is a Layer 7 load balancer with Web Application Firewall capabilities, designed to route and secure inbound HTTP/S traffic to backend web apps. It cannot inspect or filter outbound traffic originating from Azure VMs because it is not placed in the egress path between the VM subnet and the internet. Even if you added a route to send traffic to it, it is not built to evaluate and allow/deny outbound flows based on FQDN, so it fails this requirement.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door is a global, multi-region load balancer and application delivery controller that accelerates and protects inbound HTTP/S traffic from clients to your app endpoints. It does not sit inside your virtual network and has no visibility into traffic leaving VMs; it only proxies connections from the internet to your backend origins. Because it is not an egress gateway or firewall for VNet traffic, it cannot enforce FQDN-based rules on outbound downloads, so it is incorrect for this scenario.
- ✗
Azure VPN Gateway
Why it's wrong here
Azure VPN Gateway establishes an encrypted IPsec tunnel between an on-premises network and Azure VNet, or between VNets, and is used for site-to-site/point-to-site connectivity. It only forwards packets that match the IPsec security associations and does not perform deep packet inspection or application-layer filtering; there is no concept of FQDN rules in VPN Gateway. Therefore, although it can carry outbound traffic securely, it cannot selectively allow or deny downloads from URLs like windowsupdate.com, making it unsuitable.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.